From a0fb70560a3bba0ee236b774e3cd2ba8dfe9099a Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sun, 30 Sep 2018 08:39:08 -0700 Subject: [PATCH] 4.9-stable patches added patches: ib-hfi1-fix-context-recovery-when-pbc-has-an-unsupportedvl.patch ib-hfi1-invalid-user-input-can-result-in-crash.patch ib-srp-avoid-that-sg_reset-d-srp_device-triggers-an-infinite-loop.patch input-elantech-enable-middle-button-of-touchpad-on-thinkpad-p72.patch revert-usb-cdc-wdm-fix-a-sleep-in-atomic-context-bug-in-service_outstanding_interrupt.patch scsi-target-iscsi-use-bin2hex-instead-of-a-re-implementation.patch usb-remove-lpm-management-from-usb_driver_claim_interface.patch usb-usbdevfs-restore-warning-for-nonsensical-flags.patch usb-usbdevfs-sanitize-flags-more.patch --- ...covery-when-pbc-has-an-unsupportedvl.patch | 65 ++++++++++++++ ...valid-user-input-can-result-in-crash.patch | 88 +++++++++++++++++++ ...srp_device-triggers-an-infinite-loop.patch | 45 ++++++++++ ...e-button-of-touchpad-on-thinkpad-p72.patch | 31 +++++++ ...bug-in-service_outstanding_interrupt.patch | 35 ++++++++ ...n2hex-instead-of-a-re-implementation.patch | 64 ++++++++++++++ queue-4.9/series | 9 ++ ...ment-from-usb_driver_claim_interface.patch | 76 ++++++++++++++++ ...estore-warning-for-nonsensical-flags.patch | 35 ++++++++ .../usb-usbdevfs-sanitize-flags-more.patch | 88 +++++++++++++++++++ 10 files changed, 536 insertions(+) create mode 100644 queue-4.9/ib-hfi1-fix-context-recovery-when-pbc-has-an-unsupportedvl.patch create mode 100644 queue-4.9/ib-hfi1-invalid-user-input-can-result-in-crash.patch create mode 100644 queue-4.9/ib-srp-avoid-that-sg_reset-d-srp_device-triggers-an-infinite-loop.patch create mode 100644 queue-4.9/input-elantech-enable-middle-button-of-touchpad-on-thinkpad-p72.patch create mode 100644 queue-4.9/revert-usb-cdc-wdm-fix-a-sleep-in-atomic-context-bug-in-service_outstanding_interrupt.patch create mode 100644 queue-4.9/scsi-target-iscsi-use-bin2hex-instead-of-a-re-implementation.patch create mode 100644 queue-4.9/usb-remove-lpm-management-from-usb_driver_claim_interface.patch create mode 100644 queue-4.9/usb-usbdevfs-restore-warning-for-nonsensical-flags.patch create mode 100644 queue-4.9/usb-usbdevfs-sanitize-flags-more.patch diff --git a/queue-4.9/ib-hfi1-fix-context-recovery-when-pbc-has-an-unsupportedvl.patch b/queue-4.9/ib-hfi1-fix-context-recovery-when-pbc-has-an-unsupportedvl.patch new file mode 100644 index 00000000000..6f45262d045 --- /dev/null +++ b/queue-4.9/ib-hfi1-fix-context-recovery-when-pbc-has-an-unsupportedvl.patch @@ -0,0 +1,65 @@ +From d623500b3c4efd8d4e945ac9003c6b87b469a9ab Mon Sep 17 00:00:00 2001 +From: "Michael J. Ruhl" +Date: Thu, 20 Sep 2018 12:59:05 -0700 +Subject: IB/hfi1: Fix context recovery when PBC has an UnsupportedVL + +From: Michael J. Ruhl + +commit d623500b3c4efd8d4e945ac9003c6b87b469a9ab upstream. + +If a packet stream uses an UnsupportedVL (virtual lane), the send +engine will not send the packet, and it will not indicate that an +error has occurred. This will cause the packet stream to block. + +HFI has 8 virtual lanes available for packet streams. Each lane can +be enabled or disabled using the UnsupportedVL mask. If a lane is +disabled, adding a packet to the send context must be disallowed. + +The current mask for determining unsupported VLs defaults to 0 (allow +all). This is incorrect. Only the VLs that are defined should be +allowed. + +Determine which VLs are disabled (mtu == 0), and set the appropriate +unsupported bit in the mask. The correct mask will allow the send +engine to error on the invalid VL, and error recovery will work +correctly. + +Cc: # 4.9.x+ +Fixes: 7724105686e7 ("IB/hfi1: add driver files") +Reviewed-by: Mike Marciniszyn +Reviewed-by: Lukasz Odzioba +Signed-off-by: Michael J. Ruhl +Signed-off-by: Dennis Dalessandro +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/hw/hfi1/pio.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/drivers/infiniband/hw/hfi1/pio.c ++++ b/drivers/infiniband/hw/hfi1/pio.c +@@ -88,6 +88,7 @@ void pio_send_control(struct hfi1_devdat + unsigned long flags; + int write = 1; /* write sendctrl back */ + int flush = 0; /* re-read sendctrl to make sure it is flushed */ ++ int i; + + spin_lock_irqsave(&dd->sendctrl_lock, flags); + +@@ -97,9 +98,13 @@ void pio_send_control(struct hfi1_devdat + reg |= SEND_CTRL_SEND_ENABLE_SMASK; + /* Fall through */ + case PSC_DATA_VL_ENABLE: ++ mask = 0; ++ for (i = 0; i < ARRAY_SIZE(dd->vld); i++) ++ if (!dd->vld[i].mtu) ++ mask |= BIT_ULL(i); + /* Disallow sending on VLs not enabled */ +- mask = (((~0ull) << num_vls) & SEND_CTRL_UNSUPPORTED_VL_MASK) << +- SEND_CTRL_UNSUPPORTED_VL_SHIFT; ++ mask = (mask & SEND_CTRL_UNSUPPORTED_VL_MASK) << ++ SEND_CTRL_UNSUPPORTED_VL_SHIFT; + reg = (reg & ~SEND_CTRL_UNSUPPORTED_VL_SMASK) | mask; + break; + case PSC_GLOBAL_DISABLE: diff --git a/queue-4.9/ib-hfi1-invalid-user-input-can-result-in-crash.patch b/queue-4.9/ib-hfi1-invalid-user-input-can-result-in-crash.patch new file mode 100644 index 00000000000..c0cef4587d8 --- /dev/null +++ b/queue-4.9/ib-hfi1-invalid-user-input-can-result-in-crash.patch @@ -0,0 +1,88 @@ +From 94694d18cf27a6faad91487a38ce516c2b16e7d9 Mon Sep 17 00:00:00 2001 +From: "Michael J. Ruhl" +Date: Thu, 20 Sep 2018 12:58:56 -0700 +Subject: IB/hfi1: Invalid user input can result in crash + +From: Michael J. Ruhl + +commit 94694d18cf27a6faad91487a38ce516c2b16e7d9 upstream. + +If the number of packets in a user sdma request does not match +the actual iovectors being sent, sdma_cleanup can be called on +an uninitialized request structure, resulting in a crash similar +to this: + +BUG: unable to handle kernel NULL pointer dereference at 0000000000000008 +IP: [] __sdma_txclean+0x57/0x1e0 [hfi1] +PGD 8000001044f61067 PUD 1052706067 PMD 0 +Oops: 0000 [#1] SMP +CPU: 30 PID: 69912 Comm: upsm Kdump: loaded Tainted: G OE +------------ 3.10.0-862.el7.x86_64 #1 +Hardware name: Intel Corporation S2600KPR/S2600KPR, BIOS +SE5C610.86B.01.01.0019.101220160604 10/12/2016 +task: ffff8b331c890000 ti: ffff8b2ed1f98000 task.ti: ffff8b2ed1f98000 +RIP: 0010:[] [] __sdma_txclean+0x57/0x1e0 +[hfi1] +RSP: 0018:ffff8b2ed1f9bab0 EFLAGS: 00010286 +RAX: 0000000000008b2b RBX: ffff8b2adf6e0000 RCX: 0000000000000000 +RDX: 00000000000000a0 RSI: ffff8b2e9eedc540 RDI: ffff8b2adf6e0000 +RBP: ffff8b2ed1f9bad8 R08: 0000000000000000 R09: ffffffffc0b04a06 +R10: ffff8b331c890190 R11: ffffe6ed00bf1840 R12: ffff8b3315480000 +R13: ffff8b33154800f0 R14: 00000000fffffff2 R15: ffff8b2e9eedc540 +FS: 00007f035ac47740(0000) GS:ffff8b331e100000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 0000000000000008 CR3: 0000000c03fe6000 CR4: 00000000001607e0 +Call Trace: + [] user_sdma_send_pkts+0xdcd/0x1990 [hfi1] + [] ? gup_pud_range+0x140/0x290 + [] ? hfi1_mmu_rb_insert+0x155/0x1b0 [hfi1] + [] hfi1_user_sdma_process_request+0xc5b/0x11b0 [hfi1] + [] hfi1_aio_write+0xba/0x110 [hfi1] + [] do_sync_readv_writev+0x7b/0xd0 + [] do_readv_writev+0xce/0x260 + [] ? tty_ldisc_deref+0x19/0x20 + [] ? n_tty_ioctl+0xe0/0xe0 + [] vfs_writev+0x35/0x60 + [] SyS_writev+0x7f/0x110 + [] system_call_fastpath+0x1c/0x21 +Code: 06 49 c7 47 18 00 00 00 00 0f 87 89 01 00 00 5b 41 5c 41 5d 41 5e 41 5f +5d c3 66 2e 0f 1f 84 00 00 00 00 00 48 8b 4e 10 48 89 fb <48> 8b 51 08 49 89 d4 +83 e2 0c 41 81 e4 00 e0 00 00 48 c1 ea 02 +RIP [] __sdma_txclean+0x57/0x1e0 [hfi1] + RSP +CR2: 0000000000000008 + +There are two exit points from user_sdma_send_pkts(). One (free_tx) +merely frees the slab entry and one (free_txreq) cleans the sdma_txreq +prior to freeing the slab entry. The free_txreq variation can only be +called after one of the sdma_init*() variations has been called. + +In the panic case, the slab entry had been allocated but not inited. + +Fix the issue by exiting through free_tx thus avoiding sdma_clean(). + +Cc: # 4.9.x+ +Fixes: 7724105686e7 ("IB/hfi1: add driver files") +Reviewed-by: Mike Marciniszyn +Reviewed-by: Lukasz Odzioba +Signed-off-by: Michael J. Ruhl +Signed-off-by: Dennis Dalessandro +Signed-off-by: Greg Kroah-Hartman + +Signed-off-by: Jason Gunthorpe + +--- + drivers/infiniband/hw/hfi1/user_sdma.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/infiniband/hw/hfi1/user_sdma.c ++++ b/drivers/infiniband/hw/hfi1/user_sdma.c +@@ -956,7 +956,7 @@ static int user_sdma_send_pkts(struct us + if (ACCESS_ONCE(iovec->offset) == iovec->iov.iov_len) { + if (++req->iov_idx == req->data_iovs) { + ret = -EFAULT; +- goto free_txreq; ++ goto free_tx; + } + iovec = &req->iovs[req->iov_idx]; + WARN_ON(iovec->offset); diff --git a/queue-4.9/ib-srp-avoid-that-sg_reset-d-srp_device-triggers-an-infinite-loop.patch b/queue-4.9/ib-srp-avoid-that-sg_reset-d-srp_device-triggers-an-infinite-loop.patch new file mode 100644 index 00000000000..12fc0e59e29 --- /dev/null +++ b/queue-4.9/ib-srp-avoid-that-sg_reset-d-srp_device-triggers-an-infinite-loop.patch @@ -0,0 +1,45 @@ +From ee92efe41cf358f4b99e73509f2bfd4733609f26 Mon Sep 17 00:00:00 2001 +From: Bart Van Assche +Date: Mon, 17 Sep 2018 18:10:05 -0700 +Subject: IB/srp: Avoid that sg_reset -d ${srp_device} triggers an infinite loop + +From: Bart Van Assche + +commit ee92efe41cf358f4b99e73509f2bfd4733609f26 upstream. + +Use different loop variables for the inner and outer loop. This avoids +that an infinite loop occurs if there are more RDMA channels than +target->req_ring_size. + +Fixes: d92c0da71a35 ("IB/srp: Add multichannel support") +Cc: +Signed-off-by: Bart Van Assche +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/ulp/srp/ib_srp.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/infiniband/ulp/srp/ib_srp.c ++++ b/drivers/infiniband/ulp/srp/ib_srp.c +@@ -2639,7 +2639,7 @@ static int srp_reset_device(struct scsi_ + { + struct srp_target_port *target = host_to_target(scmnd->device->host); + struct srp_rdma_ch *ch; +- int i; ++ int i, j; + u8 status; + + shost_printk(KERN_ERR, target->scsi_host, "SRP reset_device called\n"); +@@ -2653,8 +2653,8 @@ static int srp_reset_device(struct scsi_ + + for (i = 0; i < target->ch_count; i++) { + ch = &target->ch[i]; +- for (i = 0; i < target->req_ring_size; ++i) { +- struct srp_request *req = &ch->req_ring[i]; ++ for (j = 0; j < target->req_ring_size; ++j) { ++ struct srp_request *req = &ch->req_ring[j]; + + srp_finish_req(ch, req, scmnd->device, DID_RESET << 16); + } diff --git a/queue-4.9/input-elantech-enable-middle-button-of-touchpad-on-thinkpad-p72.patch b/queue-4.9/input-elantech-enable-middle-button-of-touchpad-on-thinkpad-p72.patch new file mode 100644 index 00000000000..6caa4391f78 --- /dev/null +++ b/queue-4.9/input-elantech-enable-middle-button-of-touchpad-on-thinkpad-p72.patch @@ -0,0 +1,31 @@ +From 91a97507323e1ad4bfc10f4a5922e67cdaf8b3cd Mon Sep 17 00:00:00 2001 +From: Aaron Ma +Date: Tue, 18 Sep 2018 09:32:22 -0700 +Subject: Input: elantech - enable middle button of touchpad on ThinkPad P72 + +From: Aaron Ma + +commit 91a97507323e1ad4bfc10f4a5922e67cdaf8b3cd upstream. + +Adding 2 new touchpad IDs to support middle button support. + +Cc: stable@vger.kernel.org +Signed-off-by: Aaron Ma +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/mouse/elantech.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/input/mouse/elantech.c ++++ b/drivers/input/mouse/elantech.c +@@ -1176,6 +1176,8 @@ static const struct dmi_system_id elante + static const char * const middle_button_pnp_ids[] = { + "LEN2131", /* ThinkPad P52 w/ NFC */ + "LEN2132", /* ThinkPad P52 */ ++ "LEN2133", /* ThinkPad P72 w/ NFC */ ++ "LEN2134", /* ThinkPad P72 */ + NULL + }; + diff --git a/queue-4.9/revert-usb-cdc-wdm-fix-a-sleep-in-atomic-context-bug-in-service_outstanding_interrupt.patch b/queue-4.9/revert-usb-cdc-wdm-fix-a-sleep-in-atomic-context-bug-in-service_outstanding_interrupt.patch new file mode 100644 index 00000000000..5e6b8291dc3 --- /dev/null +++ b/queue-4.9/revert-usb-cdc-wdm-fix-a-sleep-in-atomic-context-bug-in-service_outstanding_interrupt.patch @@ -0,0 +1,35 @@ +From e871db8d78df1c411032cbb3acfdf8930509360e Mon Sep 17 00:00:00 2001 +From: Sebastian Andrzej Siewior +Date: Tue, 11 Sep 2018 10:00:44 +0200 +Subject: Revert "usb: cdc-wdm: Fix a sleep-in-atomic-context bug in service_outstanding_interrupt()" + +From: Sebastian Andrzej Siewior + +commit e871db8d78df1c411032cbb3acfdf8930509360e upstream. + +This reverts commit 6e22e3af7bb3a7b9dc53cb4687659f6e63fca427. + +The bug the patch describes to, has been already fixed in commit +2df6948428542 ("USB: cdc-wdm: don't enable interrupts in USB-giveback") +so need to this, revert it. + +Fixes: 6e22e3af7bb3 ("usb: cdc-wdm: Fix a sleep-in-atomic-context bug in service_outstanding_interrupt()") +Cc: stable +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/class/cdc-wdm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/class/cdc-wdm.c ++++ b/drivers/usb/class/cdc-wdm.c +@@ -470,7 +470,7 @@ static int service_outstanding_interrupt + + set_bit(WDM_RESPONDING, &desc->flags); + spin_unlock_irq(&desc->iuspin); +- rv = usb_submit_urb(desc->response, GFP_ATOMIC); ++ rv = usb_submit_urb(desc->response, GFP_KERNEL); + spin_lock_irq(&desc->iuspin); + if (rv) { + dev_err(&desc->intf->dev, diff --git a/queue-4.9/scsi-target-iscsi-use-bin2hex-instead-of-a-re-implementation.patch b/queue-4.9/scsi-target-iscsi-use-bin2hex-instead-of-a-re-implementation.patch new file mode 100644 index 00000000000..8697c8a5f32 --- /dev/null +++ b/queue-4.9/scsi-target-iscsi-use-bin2hex-instead-of-a-re-implementation.patch @@ -0,0 +1,64 @@ +From 8c39e2699f8acb2e29782a834e56306da24937fe Mon Sep 17 00:00:00 2001 +From: Vincent Pelletier +Date: Sun, 9 Sep 2018 04:09:27 +0000 +Subject: scsi: target: iscsi: Use bin2hex instead of a re-implementation + +From: Vincent Pelletier + +commit 8c39e2699f8acb2e29782a834e56306da24937fe upstream. + +Signed-off-by: Vincent Pelletier +Reviewed-by: Mike Christie +Signed-off-by: Martin K. Petersen +[plr.vincent@gmail.com: hunk context change for 4.4 and 4.9, no code change] +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/target/iscsi/iscsi_target_auth.c | 15 +++------------ + 1 file changed, 3 insertions(+), 12 deletions(-) + +--- a/drivers/target/iscsi/iscsi_target_auth.c ++++ b/drivers/target/iscsi/iscsi_target_auth.c +@@ -26,15 +26,6 @@ + #include "iscsi_target_nego.h" + #include "iscsi_target_auth.h" + +-static void chap_binaryhex_to_asciihex(char *dst, char *src, int src_len) +-{ +- int i; +- +- for (i = 0; i < src_len; i++) { +- sprintf(&dst[i*2], "%02x", (int) src[i] & 0xff); +- } +-} +- + static void chap_gen_challenge( + struct iscsi_conn *conn, + int caller, +@@ -47,7 +38,7 @@ static void chap_gen_challenge( + memset(challenge_asciihex, 0, CHAP_CHALLENGE_LENGTH * 2 + 1); + + get_random_bytes(chap->challenge, CHAP_CHALLENGE_LENGTH); +- chap_binaryhex_to_asciihex(challenge_asciihex, chap->challenge, ++ bin2hex(challenge_asciihex, chap->challenge, + CHAP_CHALLENGE_LENGTH); + /* + * Set CHAP_C, and copy the generated challenge into c_str. +@@ -281,7 +272,7 @@ static int chap_server_compute_md5( + goto out; + } + +- chap_binaryhex_to_asciihex(response, server_digest, MD5_SIGNATURE_SIZE); ++ bin2hex(response, server_digest, MD5_SIGNATURE_SIZE); + pr_debug("[server] MD5 Server Digest: %s\n", response); + + if (memcmp(server_digest, client_digest, MD5_SIGNATURE_SIZE) != 0) { +@@ -403,7 +394,7 @@ static int chap_server_compute_md5( + /* + * Convert response from binary hex to ascii hext. + */ +- chap_binaryhex_to_asciihex(response, digest, MD5_SIGNATURE_SIZE); ++ bin2hex(response, digest, MD5_SIGNATURE_SIZE); + *nr_out_len += sprintf(nr_out_ptr + *nr_out_len, "CHAP_R=0x%s", + response); + *nr_out_len += 1; diff --git a/queue-4.9/series b/queue-4.9/series index 50a724dd49a..ddeb0b6d2c9 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -66,3 +66,12 @@ usb-fix-error-handling-in-usb_driver_claim_interface.patch usb-handle-null-config-in-usb_find_alt_setting.patch slub-make-cpu_partial-unsigned-int.patch media-uvcvideo-support-realtek-s-uvc-1.5-device.patch +usb-usbdevfs-sanitize-flags-more.patch +usb-usbdevfs-restore-warning-for-nonsensical-flags.patch +revert-usb-cdc-wdm-fix-a-sleep-in-atomic-context-bug-in-service_outstanding_interrupt.patch +usb-remove-lpm-management-from-usb_driver_claim_interface.patch +input-elantech-enable-middle-button-of-touchpad-on-thinkpad-p72.patch +ib-srp-avoid-that-sg_reset-d-srp_device-triggers-an-infinite-loop.patch +ib-hfi1-invalid-user-input-can-result-in-crash.patch +ib-hfi1-fix-context-recovery-when-pbc-has-an-unsupportedvl.patch +scsi-target-iscsi-use-bin2hex-instead-of-a-re-implementation.patch diff --git a/queue-4.9/usb-remove-lpm-management-from-usb_driver_claim_interface.patch b/queue-4.9/usb-remove-lpm-management-from-usb_driver_claim_interface.patch new file mode 100644 index 00000000000..b560706aebb --- /dev/null +++ b/queue-4.9/usb-remove-lpm-management-from-usb_driver_claim_interface.patch @@ -0,0 +1,76 @@ +From c183813fcee44a249339b7c46e1ad271ca1870aa Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Mon, 10 Sep 2018 13:58:51 -0400 +Subject: USB: remove LPM management from usb_driver_claim_interface() + +From: Alan Stern + +commit c183813fcee44a249339b7c46e1ad271ca1870aa upstream. + +usb_driver_claim_interface() disables and re-enables Link Power +Management, but it shouldn't do either one, for the reasons listed +below. This patch removes the two LPM-related function calls from the +routine. + +The reason for disabling LPM in the analogous function +usb_probe_interface() is so that drivers won't have to deal with +unwanted LPM transitions in their probe routine. But +usb_driver_claim_interface() doesn't call the driver's probe routine +(or any other callbacks), so that reason doesn't apply here. + +Furthermore, no driver other than usbfs will ever call +usb_driver_claim_interface() unless it is already bound to another +interface in the same device, which means disabling LPM here would be +redundant. usbfs doesn't interact with LPM at all. + +Lastly, the error return from usb_unlocked_disable_lpm() isn't handled +properly; the code doesn't clean up its earlier actions before +returning. + +Signed-off-by: Alan Stern +Fixes: 8306095fd2c1 ("USB: Disable USB 3.0 LPM in critical sections.") +CC: +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/driver.c | 15 --------------- + 1 file changed, 15 deletions(-) + +--- a/drivers/usb/core/driver.c ++++ b/drivers/usb/core/driver.c +@@ -509,7 +509,6 @@ int usb_driver_claim_interface(struct us + struct device *dev; + struct usb_device *udev; + int retval = 0; +- int lpm_disable_error = -ENODEV; + + if (!iface) + return -ENODEV; +@@ -530,16 +529,6 @@ int usb_driver_claim_interface(struct us + + iface->condition = USB_INTERFACE_BOUND; + +- /* See the comment about disabling LPM in usb_probe_interface(). */ +- if (driver->disable_hub_initiated_lpm) { +- lpm_disable_error = usb_unlocked_disable_lpm(udev); +- if (lpm_disable_error) { +- dev_err(&iface->dev, "%s Failed to disable LPM for driver %s\n.", +- __func__, driver->name); +- return -ENOMEM; +- } +- } +- + /* Claimed interfaces are initially inactive (suspended) and + * runtime-PM-enabled, but only if the driver has autosuspend + * support. Otherwise they are marked active, to prevent the +@@ -558,10 +547,6 @@ int usb_driver_claim_interface(struct us + if (device_is_registered(dev)) + retval = device_bind_driver(dev); + +- /* Attempt to re-enable USB3 LPM, if the disable was successful. */ +- if (!lpm_disable_error) +- usb_unlocked_enable_lpm(udev); +- + if (retval) { + dev->driver = NULL; + usb_set_intfdata(iface, NULL); diff --git a/queue-4.9/usb-usbdevfs-restore-warning-for-nonsensical-flags.patch b/queue-4.9/usb-usbdevfs-restore-warning-for-nonsensical-flags.patch new file mode 100644 index 00000000000..5b8f25a7dfb --- /dev/null +++ b/queue-4.9/usb-usbdevfs-restore-warning-for-nonsensical-flags.patch @@ -0,0 +1,35 @@ +From 81e0403b26d94360abd1f6a57311337973bc82cd Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Wed, 5 Sep 2018 12:07:03 +0200 +Subject: USB: usbdevfs: restore warning for nonsensical flags + +From: Oliver Neukum + +commit 81e0403b26d94360abd1f6a57311337973bc82cd upstream. + +If we filter flags before they reach the core we need to generate our +own warnings. + +Signed-off-by: Oliver Neukum +Fixes: 0cb54a3e47cb ("USB: debugging code shouldn't alter control flow") +Cc: stable +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/devio.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/usb/core/devio.c ++++ b/drivers/usb/core/devio.c +@@ -1714,6 +1714,11 @@ static int proc_do_submiturb(struct usb_ + u |= URB_NO_INTERRUPT; + as->urb->transfer_flags = u; + ++ if (!allow_short && uurb->flags & USBDEVFS_URB_SHORT_NOT_OK) ++ dev_warn(&ps->dev->dev, "Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK.\n"); ++ if (!allow_zero && uurb->flags & USBDEVFS_URB_ZERO_PACKET) ++ dev_warn(&ps->dev->dev, "Requested nonsensical USBDEVFS_URB_ZERO_PACKET.\n"); ++ + as->urb->transfer_buffer_length = uurb->buffer_length; + as->urb->setup_packet = (unsigned char *)dr; + dr = NULL; diff --git a/queue-4.9/usb-usbdevfs-sanitize-flags-more.patch b/queue-4.9/usb-usbdevfs-sanitize-flags-more.patch new file mode 100644 index 00000000000..6b79963b5aa --- /dev/null +++ b/queue-4.9/usb-usbdevfs-sanitize-flags-more.patch @@ -0,0 +1,88 @@ +From 7a68d9fb851012829c29e770621905529bd9490b Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Wed, 5 Sep 2018 12:07:02 +0200 +Subject: USB: usbdevfs: sanitize flags more + +From: Oliver Neukum + +commit 7a68d9fb851012829c29e770621905529bd9490b upstream. + +Requesting a ZERO_PACKET or not is sensible only for output. +In the input direction the device decides. +Likewise accepting short packets makes sense only for input. + +This allows operation with panic_on_warn without opening up +a local DOS. + +Signed-off-by: Oliver Neukum +Reported-by: syzbot+843efa30c8821bd69f53@syzkaller.appspotmail.com +Fixes: 0cb54a3e47cb ("USB: debugging code shouldn't alter control flow") +Cc: stable +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/devio.c | 19 ++++++++++++++++--- + 1 file changed, 16 insertions(+), 3 deletions(-) + +--- a/drivers/usb/core/devio.c ++++ b/drivers/usb/core/devio.c +@@ -1450,10 +1450,13 @@ static int proc_do_submiturb(struct usb_ + struct async *as = NULL; + struct usb_ctrlrequest *dr = NULL; + unsigned int u, totlen, isofrmlen; +- int i, ret, is_in, num_sgs = 0, ifnum = -1; ++ int i, ret, num_sgs = 0, ifnum = -1; + int number_of_packets = 0; + unsigned int stream_id = 0; + void *buf; ++ bool is_in; ++ bool allow_short = false; ++ bool allow_zero = false; + unsigned long mask = USBDEVFS_URB_SHORT_NOT_OK | + USBDEVFS_URB_BULK_CONTINUATION | + USBDEVFS_URB_NO_FSBR | +@@ -1487,6 +1490,8 @@ static int proc_do_submiturb(struct usb_ + u = 0; + switch (uurb->type) { + case USBDEVFS_URB_TYPE_CONTROL: ++ if (is_in) ++ allow_short = true; + if (!usb_endpoint_xfer_control(&ep->desc)) + return -EINVAL; + /* min 8 byte setup packet */ +@@ -1527,6 +1532,10 @@ static int proc_do_submiturb(struct usb_ + break; + + case USBDEVFS_URB_TYPE_BULK: ++ if (!is_in) ++ allow_zero = true; ++ else ++ allow_short = true; + switch (usb_endpoint_type(&ep->desc)) { + case USB_ENDPOINT_XFER_CONTROL: + case USB_ENDPOINT_XFER_ISOC: +@@ -1547,6 +1556,10 @@ static int proc_do_submiturb(struct usb_ + if (!usb_endpoint_xfer_int(&ep->desc)) + return -EINVAL; + interrupt_urb: ++ if (!is_in) ++ allow_zero = true; ++ else ++ allow_short = true; + break; + + case USBDEVFS_URB_TYPE_ISO: +@@ -1691,11 +1704,11 @@ static int proc_do_submiturb(struct usb_ + u = (is_in ? URB_DIR_IN : URB_DIR_OUT); + if (uurb->flags & USBDEVFS_URB_ISO_ASAP) + u |= URB_ISO_ASAP; +- if (uurb->flags & USBDEVFS_URB_SHORT_NOT_OK && is_in) ++ if (allow_short && uurb->flags & USBDEVFS_URB_SHORT_NOT_OK) + u |= URB_SHORT_NOT_OK; + if (uurb->flags & USBDEVFS_URB_NO_FSBR) + u |= URB_NO_FSBR; +- if (uurb->flags & USBDEVFS_URB_ZERO_PACKET) ++ if (allow_zero && uurb->flags & USBDEVFS_URB_ZERO_PACKET) + u |= URB_ZERO_PACKET; + if (uurb->flags & USBDEVFS_URB_NO_INTERRUPT) + u |= URB_NO_INTERRUPT; -- 2.47.3